Security audit
Security checks for vulnerabilities and agentic risk
The skill has real token-compression features, but included memory and proxy components can expose private chats or run powerful agent actions without strong safeguards.
Review this carefully before installing. Use only the deterministic compression features unless you explicitly need Engram or the proxy. Do not run the proxy without setting a strong PROXY_AUTH_TOKEN, binding it to loopback or a protected network, and avoiding USE_CLI_AGENTS unless it is sandboxed. Do not point OPENAI_BASE_URL at an untrusted or plaintext remote endpoint, and periodically inspect/delete memory under memory/engram.
proxy/server.mjs:531Default-Open Proxy Exposes a Full-Permission Autonomous Agent
scripts/lib/engram_storage.py:38Unvalidated Thread IDs Permit Filesystem Path Traversal
scripts/lib/engram.py:310Untrusted Conversation Data Can Poison Persistent System Context
scripts/lib/engram.py:128Configurable LLM Endpoint Can Receive Conversation Data and Provider Credentials
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!--
<script type="application/ld+json">
{
"@context": "https://schema.org",
The Engram section instructs users to configure API endpoints and keys and describes observing, reflecting, ingesting, and daemonizing conversation processing, but it does not clearly warn that conversation content may be sent to an external or custom LLM endpoint and then stored persistently under memory/engram/. In a memory-processing skill, this materially increases privacy and data-exfiltration risk because sensitive prompts, credentials, internal discussions, or regulated data could be transmitted and retained without informed consent.
Referenced artifact was not completely inspected
python3 scripts/engram_auto.py --workspace ~/.openclaw/workspace
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ---------------------------------------------------------------------------
def _load_env() -> None:
env_path = Path(__file__).parent.parent / ".env"
if env_path.exists():
for line in env_path.read_text().splitlines():
line = line.strip()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ---------------------------------------------------------------------------
def _load_env() -> None:
env_path = Path(__file__).parent.parent / ".env"
if env_path.exists():
for line in env_path.read_text().splitlines():
line = line.strip()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ---------------------------------------------------------------------------
def _load_env() -> None:
env_path = Path(__file__).parent.parent / ".env"
if env_path.exists():
for line in env_path.read_text().splitlines():
line = line.strip()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ---------------------------------------------------------------------------
def _load_env() -> None:
env_path = Path(__file__).parent.parent / ".env"
if env_path.exists():
for line in env_path.read_text().splitlines():
line = line.strip()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ---------------------------------------------------------------------------
def _load_env() -> None:
env_path = Path(__file__).parent.parent / ".env"
if env_path.exists():
for line in env_path.read_text().splitlines():
line = line.strip()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ---------------------------------------------------------------------------
def _load_env() -> None:
env_path = Path(__file__).parent.parent / ".env"
if env_path.exists():
for line in env_path.read_text().splitlines():
line = line.strip()
EngramCompressor sends full conversation content to an OpenAI-compatible endpoint over plain HTTP while also attaching an Authorization bearer token. This exposes sensitive prompt data and credentials to interception on the local network, proxies, or misconfigured hosts, and the module provides no trust boundary, consent, or manifest justification for the exfiltration.
The backup cleanup loop derives object names from aws s3 ls output and passes them directly into aws s3 rm, relying on fragile text parsing and weak date extraction. If object names are malformed, unexpected, or intentionally crafted, the script can delete the wrong backups or remove more data than intended, causing destructive data loss in the backup store.
{"role": "user", "content": "Will add disk monitoring. Our backup strategy is manual rsync. Should we automate this?", "ts": "2026-03-05T10:35:00Z"},
{"role": "assistant", "content": "Yes, absolutely automate backups. Recommended stack:\n1. **Database**: `pg_dump` or `mysqldump` → compress → S3 (use `aws s3 cp` or `rclone`)\n2. **Files**: `restic` — deduplication, encryption, S3/B2 backend, excellent retention policies\n3. **Schedule**: cron or systemd timers\n4. **Test restores**: Monthly restore test to verify backups are valid\n5. **3-2-1 rule**: 3 copies, 2 different media, 1 offsite (S3 is your offsite)\n\nRestic example: `restic -r s3:s3.amazonaws.com/my-backups backup /data --password-file /etc/restic-password`", "ts": "2026-03-05T10:35:30Z"},
{"role": "user", "content": "We use Postgres. Show me a complete backup script.", "ts": "2026-03-05T10:36:00Z"},
{"role": "assistant", "content": "```bash\n#!/bin/bash\n# postgres-backup.sh — Daily Postgres backup to S3\n\nset -euo pipefail\n\nDATE=$(date +%Y-%m-%d-%H%M)\nDB_NAME=\"myapp\"\nBACKUP_DIR=\"/tmp/backups\"\nS3_BUCKET=\"s3://my-company-backups/postgres\"\n\nmkdir -p \"$BACKUP_DIR\"\n\n# Dump all databases\npg_dumpall -U postgres | gzip > \"$BACKUP_DIR/postgres-$DATE.sql.gz\"\n\n# Upload to S3\naws s3 cp \"$BACKUP_DIR/postgres-$DATE.sql.gz\" \"$S3_BUCKET/postgres-$DATE.sql.gz\"\n\n# Verify upload\naws s3 ls \"$S3_BUCKET/postgres-$DATE.sql.gz\" || { echo 'Upload failed!'; exit 1; }\n\n# Cleanup local backup\nrm -f \"$BACKUP_DIR/postgres-$DATE.sql.gz\"\n\n# Delete S3 backups older than 30 days\naws s3 ls \"$S3_BUCKET/\" | awk '{print $4}' | while read f; do\n fdate=$(echo \"$f\" | grep -oP '\\d{4}-\\d{2}-\\d{2}' | head -1)\n if [[ $(date -d \"$fdate\" +%s 2>/dev/null) -lt $(date -d '30 days ago' +%s) ]]; then\n aws s3 rm \"$S3_BUCKET/$f\"\n fi\ndone\n\necho \"Backup completed: postgres-$DATE.sql.gz\"\n```\n\nAdd to cron: `0 2 * * * /opt/scripts/postgres-backup.sh >> /var/log/backup.lo
...[truncated 25 chars]
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# engram.yaml — Engram unified configuration
# Place this file in the claw-compactor root directory.
# All paths support ~ expansion. Sensitive values stay in .env (not here).
llm:
# Provider: "anthropic" or "openai-compatible"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
}
// Build the appendix with actual dynamic values
const appendixLines = ["", "---", "<!-- quantum-lock: dynamic context -->"];
for (const { name, original } of fragments) {
appendixLines.push(`${name}: ${original}`);
}
The proxy is explicitly designed to launch Claude CLI with --dangerously-skip-permissions, giving model-driven subprocesses unrestricted tool execution without per-request user approval. In a proxy that accepts remote chat completion requests, this creates a direct path from untrusted prompt input to autonomous command execution on the host and any reachable environment, making prompt injection or abuse highly dangerous.
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal (+2 more)